CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0	Exploit Mitigation Third Party Advisory
https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudark:kubeplus:4.1.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-30 17:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-29954

Mitre link : CVE-2026-29954

CVE.ORG link : CVE-2026-29954

JSON object : View

Products Affected

cloudark

kubeplus

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-29954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29954", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:40:31.139944Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-30T17:16:15.867", "references": [{"url": "https://gist.github.com/b0b0haha/33baea60fd2a847f11f1fb02e43c64c0", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/b0b0haha/CVE-2026-29954/blob/main/README.md", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-88"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to download charts, the chartURL is directly concatenated into the command, allowing attackers to inject wget's `--header` option to achieve arbitrary HTTP header injection."}, {"lang": "es", "value": "En KubePlus 4.1.4, los componentes mutating webhook y kubeconfiggenerator tienen una vulnerabilidad SSRF al procesar el campo chartURL de los recursos ResourceComposition. El campo solo est\u00e1 codificado en URL sin validar la direcci\u00f3n de destino. M\u00e1s cr\u00edticamente, cuando kubeconfiggenerator utiliza wget para descargar charts, la chartURL se concatena directamente en el comando, permitiendo a los atacantes inyectar la opci\u00f3n --header de wget para lograr la inyecci\u00f3n arbitraria de encabezados HTTP."}], "lastModified": "2026-06-17T10:29:57.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudark:kubeplus:4.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0807B33-5182-4003-A830-0D8F9633C3A1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}